In various types of vital control systems, such as, in cab signaling apparatus for railroad and mass and/or rapid transit operations, it is extremely important to utilize the utmost care in designing and laying out electrical circuits or networks. It will be appreciated that in order to provide the highest degree of safety to individuals and also to afford the greatest amount of protection to the equipment, it is necessary to ensure that under no circumstance will a critical component or circuit failure be capable of producing an unsafe condition. Therefore, it is mandatory that the control apparatus must operate in a fail-safe manner so that any conceivable failure will result in a condition at least as restrictive and preferably more restrictive than that preceding the failure. For example, a circuit malfunction or a component failure in a vital speed control system must not be permitted to simulate or indicate a condition for causing an increase in the speed of a vehicle. A vital piece of apparatus or equipment is considered to operate in a fail-safe manner when any critical component or circuit failure results in a safe condition according to the definition of the Association of American Railroads (AAR).
In a cab signal speed control system, it is imperative that a motorman or operator must take appropriate action within a given period of time after a more restrictive speed command is received on board from the wayside. That is, after receiving a more restrictive or lower speed signal, the operator must immediately acknowledge the speed reduction command by decelerating the moving train to the newly received prescribed speed or the emergency brakes will be set after elapse of the given period of time. It will be understood that the acknowledgment of the speed reduction and initiation of the vehicle deceleration should take place as soon as possible after reception of the more restrictive signal in order to prevent the train from going too fast and too far beyond a safe braking and stopping point. It will be appreciated that the given period of time from the reception of the more restrictive signal to the acknowledgment by the operator must not be capable of being lengthened or increased due to a component or circuit failure. Previously, a capacitor was employed for the given period of time before actuation of the emergency brakes. However, the amount of potential charge required for holding the vital relay energized was relatively large which necessitated an extremely large capacitor which is bulky and costly. In addition, it is beneficial from a size and weight standpoint to attempt to use a capacitor of a small value in place of an extremely large one to provide the necessary time delay. However, as mentioned above, the time delay circuit must operate in a fail-safe manner in that no critical component or circuit failure is capable of extending the expiration of the time period to produce an unsafe condition.